{"id":"CVE-2025-71286","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls\n\nThe size of the data behind of scontrol->ipc_control_data for bytes\ncontrols is:\n[1] sizeof(st…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls\n\nThe size of the data behind of scontrol->ipc_control_data for bytes\ncontrols is:\n[1] sizeof(st…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.4, < 6.6.128","linux_kernel >= 6.7, < 6.12.75","linux_kernel >= 6.13, < 6.18.16","linux_kernel >= 6.19, < 6.19.6"],"patched":["linux_kernel 6.19.6"],"published":"2026-05-06","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71286","references":[{"url":"https://git.kernel.org/stable/c/1237cd9ff198cb882402572f29569e5247190974","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/491956b45b5f4933632ea6d8a8bdfdf045ab81e1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59fe643f21b9d59bcbedb0dfbf988ee455c23736","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a653820700b81c9e6f05ac23b7969ecec1a18e85","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a704a1a4394b5877b9adc31b2c3165ad0b541896","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00138,"epssPercentile":0.02791,"ingestedAt":"2026-10-14T13:30:58.486Z","slug":"CVE-2025-71286","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls\n\nThe size of the data behind of scontrol->ipc_control_data for bytes\ncontrols is:\n[1] sizeof(struct sof_ipc4_control_data) + // kernel only struct\n[2] sizeof(struct sof_abi_hdr)) + payload\n\nThe max_size specifies the size of [2] and it is coming from topology.\n\nChange the function to take this into account and allocate adequate amount\nof memory behind scontrol->ipc_control_data.\n\nWith the change we will allocate [1] amount more memory to be able to hold\nthe full size of data.\n\n## Affected\n\n- `linux_kernel >= 6.4, < 6.6.128`\n- `linux_kernel >= 6.7, < 6.12.75`\n- `linux_kernel >= 6.13, < 6.18.16`\n- `linux_kernel >= 6.19, < 6.19.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.6`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}